janus deployment

2026-07-04 23:19:35 -05:00
parent f2ba5d914c
commit b1f4b6ad41
5 changed files with 54 additions and 77 deletions
@@ -3,7 +3,7 @@ keys:
  - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
  - &test-nix age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
  - &soteria age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
-  - &janus age1n94nkvmzezdj08t4dpwukd7s5k4cx2rldwvx9x5qhx3xhqm48yhq6ejldt
+  - &janus age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3
 creation_rules:
  - path_regex: modules/hosts/janus/secrets\.yaml$
    key_groups:
@@ -11,49 +11,49 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQytmUDE3NVg1RWlYcjVq
-            RVp6dHlqOHlNdXAyWkNlOVlGQlIwZERpdFRrCk1CTW84Q1B0MEFKTmpFM2FNS3lE
-            NDY4b0k3dTdST1VyQlFZVUhGSlpudDgKLS0tIHlVZDBrd0VFSWRsUGtpVjVIYnUx
-            VGc0WjlNSzE1U2h2cFNZekxoNUhSdVUKYpl5ZlZpH5zvfNUVrPdd+dqwZ16zJn7D
-            cbc5xZLtDpoeG3ZQQeV9T4WGTKycZN8Wo13Iw7BtQL/zUnUU8L/y8g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwWlpYV1o3SVdJdmJ5TWM3
+            Qmg4WVkvL21aQ2wvMUcxeGIxL2FQRUNOZFhZCkFqT3RtNTZvODJZczVwcEZkMzBp
+            eFFTVmJLb1ZOQVVVSWl4OVNQWkM4VWcKLS0tIEV4WmhEOGpkUWFBTCtqaldxdXFO
+            T20rVXNrY0ZBWlBaS0lWdGIrYUFNdm8KL06MsEu0fy6gKX5khZoxaypKDgEEJnTL
+            hCh4sCmTC3l7vQLv6deWf1Xhc8vSYhhNaWFCZ+KSaUen+6Bm/WrRIg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6czRVNUhGaFV1U0dUKzNp
-            YVl0TGZBTnBIaS96dWo2S3BZUFBSclhITkJNCkZZU0dCdnA4d1VVOFRjU2JueG1C
-            MndFazdFZG5CbEdPU2xSS24xNnBHQ2sKLS0tIFh3TWxydi96alBKRkpqa3VKekUx
-            ck5hbU1ValNJU2d1cTVTZU10NSsxVkEK5/dMd08yTRKNmunA3u7RYtJsaYVRD/cG
-            cXL2g5ewWl/vhFH71pwCpXIyEhKCF1U6HR9VlesnwU8ZOON59n9FKg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRGVJTXJtSk9KUFpCdksv
+            SUJ4YXBSTndhZkVHNlV2TTlyS0MrQXdqOG1jCkk0c3p0ZUlHMzZmR0FTUTMxOTl1
+            c0dFTW9yZFpuSUdwVUs0dlJiL2d2cFUKLS0tIE1VWldEYmR6cWFoRTkycmllVnpt
+            TGYxU2J0NzAvMjBMOXVMZEJTYTNkamMK2zfuTeHJ/8I07oNhp3MN1wKlmtVpahke
+            cz8FVesp/+53HxfQAdnC7l/Cv7P71aVEyr2/oTEd4gt9HsHVVw3O6A==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVWlDaTdpK2t1Z1pTbmZO
-            V2o5VW9oa3c3eE9Yc2lzaWtJdk5KcWZFTUQ4CkI2UnN3NWxQOUVwaDFXWmY0ODBU
-            NXFHeEYwYnUvVkRmNzFQZVNUZHd3bjgKLS0tIDA2Q2J2bnVGUHJ6UEIzNHpmbTRL
-            U284VStkZ3MyS0x2RTA4akJPRmJtbU0KSKpSQDPiC+m6ta9kYb5J2uYstW2fz2Xq
-            zVYs/F1727hasnwTOnR+rdN2k72dpxof1T6CxRKWZ3xjkvFqis2Nhg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwR3VEWmZ4REpUN0M5NTRT
+            U1l1S0k1MnFrYnhRanB4UStOQU0vYXE0TjFZCld2cDBlRXNyRlJWMlZ4TENadURy
+            cUN0RmpYYld3WlY0TzkyNXlqbFVnKzgKLS0tIHhtSG5VU3RMclMyZFJmbk1DMkV6
+            elRhVTV6Tk5OTjUybldvUXY3Sk9hdkEKg17Pagk12Pvj6cNr49HN8tImM4w7pnkc
+            XLCWIHUCe3QpJlgs4USXbyA06PmsNl7PVvCoxmf6tPegt+SFMTuDRQ==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbFUxTmhablI5SEczeWlV
-            Q20vYzFGR21GUzNQZVdSb3hCOXNNMUN5K3dNCi9FeEpPcHJCV0t1eU5VMmNzclla
-            eWdWL2RVMXZMbHhPN2Z1NHdBRnBpQnMKLS0tIG5XR1QrOXJQNHRNQzZvU0hVaFpv
-            eU82a3Y4enZpUTJIU0dObkkxa1J5K0kKoiSmt5LcM8U82pwwsvMBsgEbQ6u3+156
-            GFXQFp2+gk8zsxtzCkW1nl52Bw3GfXS7cJTW3jOVBw/YquDTc8nhXQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUUtJWklHTGpLYTJuMkZi
+            N2YzMlBUU3dxUGZwSUJjRktVYmp4RlowZ0c0CmdWdmFOQndpQWM0a0VOZUtlckhz
+            SktRclh5ZFZLaCt2RjhIdGU1aUs0c2sKLS0tIGI4UGFUcHhPVis5Z3dhanhiMGwv
+            OXRWQnNKcU9XRVJRWWdUNTZyZUdETzAKSchzGq3teDdBiyzJEujlxPaoJsVww4JX
+            3VvsUZLxnV1yWu83X1bp6uZA3YLMdQgPcHezdgmIyixp+ATHh9fgzw==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETlZVQ2RyT21KeWtNRFd6
-            ZytTWStEdFZkaG9jZzJkU253SzE1VUgvQkNNCk1QTDF6dGo4aXF2TmhtRlcrM3dk
-            Z25kVXZxQTlJY1pIMXZQOU9FdWN6T1UKLS0tIGhBU0FVNHd6cWhiZzh3Skp6Nzdz
-            SHhEMndWN1Z1TlRoajRnSEZ1UmFvbmsKR79t34F3rjQg6IzQEIc7W/VUjpHLgFus
-            wlMkfHfZqUDo/ORvOJmT337l2XuK/spbsNlYqfupCWUbvtMZNhnkAg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHFwemUyc2pEKzlibVBo
+            MlI4R0VTMHpwK21MaXZkSUp5dnIwUnVZOFRvCjVsM3FrclFJL0s2a1RwU1F2VXNF
+            MnRBOVUydFdEWXY3Mk9oTGw5Z05Zb28KLS0tIE9QRFdCVGR1Z0UyeE5KSzgrWnpP
+            Q25nZWx3bFdlek1OSjJsSk1QREdGRU0K++hDWzoKbBkGkMAkruuEwQKa1Jrc8POs
+            liN274cEdi1T6nmwBJ05w0alUR2XuYEn9HNKdvz8EntNuKIhCpHing==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1n94nkvmzezdj08t4dpwukd7s5k4cx2rldwvx9x5qhx3xhqm48yhq6ejldt
+          recipient: age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3
    lastmodified: "2026-03-15T15:06:29Z"
    mac: ENC[AES256_GCM,data:cF/TJ8VkzrHRUrO5iGdRdlFtqV/5EQ15JwQKIywJvsh0NERK67T21czSP7923MiL0u5QTVPn/rO8R5E/8gBu3r8+fLq+CFl9PDQHEX2JhnYOD5WZR412WMZq3MVR94IMTOrQANMVpS4uhMyvnrqOe4AenxLDyzrYhkwf1KQh4w0=,iv:Qwy8z4uXGMlf+kTMNiE42M9l8LtSJ+O7diknRrsSeYI=,tag:qlCY9r8HnEDmq/jw59C/sg==,type:str]
    unencrypted_suffix: _unencrypted
@@ -5,8 +5,8 @@ Generate passwords:
 mkdir -p /tmp/janus-step-ca-bootstrap && chmod 700 /tmp/janus-step-ca-bootstrap && cd /tmp/janus-step-ca-bootstrap && umask 077 && openssl rand -base64 48 > ca_password.txt && openssl rand -base64 48 > admin_jwk_password.txt
 ```

-Generate the Janus OpenSSH host key that Nix will materialize from SOPS at
-`/etc/ssh/ssh_host_ed25519_key`:
+Generate the Janus OpenSSH host key for reference (Janus now uses whatever key
+already exists on the target at `/etc/ssh/ssh_host_ed25519_key`):

 ```shell
 ssh-keygen -t ed25519 -N '' -C [email protected] -f /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key
@@ -24,24 +24,9 @@ Insert generated runtime CA material into `modules/hosts/janus/secrets.yaml` und
 - `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_host_ca_key` -> `ssh_host_ca_key`
 - `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_user_ca_key` -> `ssh_user_ca_key`
 - `/tmp/janus-step-ca-bootstrap/step/config/ca.json` -> `admin_provisioner_encrypted_key` (copy `authority.provisioners[].encryptedKey` for the `admin` JWK provisioner)
- `/tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key` -> `ssh_host_ed25519_key`

 If you are only validating wiring first, `admin_provisioner_encrypted_key` can be an encrypted placeholder and replaced later.

-The checked-in `ssh_host_ed25519_key` value is also only an encrypted placeholder.
-Replace it before deploying Janus, otherwise OpenSSH and SSH host certificate
-issuance will fail because the materialized host key is not a valid private key.
-
-For multiline secret values, avoid putting private key contents in shell history.
-One safe non-interactive pattern is to JSON-encode the file content and pass that
-temporary JSON file to `sops set --value-file`:
-
-```shell
-jq -Rs . /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key > /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json
-sops --config .sops.yaml set --value-file modules/hosts/janus/secrets.yaml '["janus"]["ssh_host_ed25519_key"]' /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json
-rm -f /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json
-```
-
 If rotating provisioner password, also set:

 - `/tmp/janus-step-ca-bootstrap/admin_jwk_password.txt` -> `janus.admin_jwk` in `keys/secrets.yaml`
@@ -49,7 +34,6 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:

 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
- `modules/hosts/janus/secrets.yaml`: Janus OpenSSH host private key (`ssh_host_ed25519_key`) materialized to `/etc/ssh/ssh_host_ed25519_key`
 - `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts

 Then update public artifacts in repo from generated output:
@@ -2,6 +2,8 @@
 let
  username = "john";
  hostname = "janus";
+  ipv4 = "192.168.1.32";
+  ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
 in
 {
  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
@@ -22,27 +24,17 @@ in
          "Step-CA" = "step-ca";
        };
        sops.defaultSopsFile = ./secrets.yaml;
-        sops.secrets."janus/ssh_host_ed25519_key" = {
-          sopsFile = ./secrets.yaml;
-          owner = "root";
-          group = "root";
-          mode = "0600";
-          path = "/etc/ssh/ssh_host_ed25519_key";
-          restartUnits = [ "sshd.socket" "step-ssh-host-renew.service" ];
-        };
        step-ssh-host = {
          hostname = hostname;
-          extraPrincipals = [
-            "192.168.1.244"
-            "fded:fb16:653e:25da:be24:11ff:fea0:753f"
-          ];
+          extraPrincipals = [ ipv4 ipv6 ];
        };
        step-ca = {
          rootCertPath = ./root_ca.crt;
          intermediateCertPath = ./intermediate_ca.crt;
          dnsNames = [
            "${hostname}.john-stream.com"
-            "192.168.1.244"
+            ipv4
+            ipv6
          ];
          secrets = {
            sopsFile = ./secrets.yaml;
@@ -53,17 +45,18 @@ in
            adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key";
          };
        };
+        step-client.caUrl = "https://${ipv4}/";
        mtls = {
          enable = true;
          subject = hostname;
          san = [
            "${hostname}.john-stream.com"
-            "192.168.1.244"
+            ipv4
          ];
          bootstrap = {
            enable = true;
-            after = [ "network-online.target" "sops-nix.service" "step-ca.service" ];
-            wants = [ "network-online.target" "step-ca.service" ];
+            after = [ "sops-nix.service" "step-ca.service" ];
+            wants = [ "step-ca.service" ];
            provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
          };
        };
@@ -9,29 +9,29 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdFNwM2JQSVlFZXpJZ0VQ
-            eDFYek1TMnNTM3lLbjh4SG56VDl6MGsvb1drCnpLbGZ1N2FwSmRacitFVDJxaFlD
-            Vk5XeCtxRGM0OGV2UFNwQmlFV1pLS1EKLS0tIHB5bm1iRG9WWmpjTlBKcWkwWktz
-            SWVQOVlJU3RBejdpaGpyTTAzVmh0MFkK6nLey1QwSw5J8WeDdUIjJo62pylqOKmP
-            +GANs3OQkRuwW2+nwG+LJR2pfUS6O6PDOz7ZWGKih90/Bk7EMtjOIQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZ1pQQW1rekYzUDFGcXBW
+            M2RHSXUvbCtvemtHYUljNmxXOCt4dEczYUU0CkdFWDRBYWRhQStYb1RtbEFmZVk4
+            bWxMTnhKVXlZWDRlcWZHWWhaSC9KMW8KLS0tIER6VWJGY28ramk2NDhZa0x5RU1s
+            YmU5S1FCVkJyNTNIVXhJSkdQVHYxMVkKEkbFmD4a7FWC8cKpZu2ZVot5ibheTQ1h
+            H6uqwAYT/UIXqnceyZyoT9JRcZyQy7xAUAJzQMe+TxUr+8iHAm7aBg==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1n94nkvmzezdj08t4dpwukd7s5k4cx2rldwvx9x5qhx3xhqm48yhq6ejldt
+          recipient: age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyeE04L0RvYmlnaWpxUWhm
-            M01vQVc2bFdNZ2k4TjJBOWZDTlV1V2VkVGd3CnhseTlOZWtqbmpldXUrWnRxSWdR
-            dFFPTFZtSlZjZVdKMDdYQkVJeG5wZUUKLS0tIGxRbEE3ZjNrUTlLSDMrVVIzbnJ5
-            cEFnNmErTlhQMEtZM282STVRUGl0dVkKDyyTGVFDm6u+cdGu/PzFUFgj6ewCf0fi
-            vFhmYA8bTGNg6loThbYxm4uN1u+mJgwOKJ3FRR+u9yYEF6xvqrIbdw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWjBiVDJSZFRQYis3dSt5
+            OFFMbGhyaHgxSDBjdnVMSlZ5d3B0eEhVM0VVCmw4TXk2a0s3ZDRCeHhEVFpGRkpl
+            b1lSQUJPL0hNRk50UEhHejNkL2VRd1EKLS0tICtXaWVMN0FSejNsNGNTOGh1WG13
+            aFJINlNKOVNhc3VBOU00VXYyMTRFdVkKV251o5CegRdDxvhpOJjK5ITp/+DVBE9o
+            R3eAsTXG5SSN50rcZYjwoEgYUeiRB4dQ/NYw6lVDUFrOf/a7sAr32g==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjeHQ4aDlSU2M2bzE1ODFY
-            Ym1NNEFFaVhrVlR0WUs1ZUVwTFVGN3QwMFZJCmdJWWFaeHByUlB2U3FLbEpwRkJI
-            ckRTNWx2dVl3Mi9ZNjhwUFNTdjZIaTAKLS0tIDZ0dFpCa2F3aFRCYmh2N3Nwb2dF
-            ZUJxakM3Wnc3U3JwTklPcllydXZBUXcKlf9C2/Gb9H9PdEKHdAd48dsalm43vYIz
-            ODYoLItstmJvT/rZ+XijZFALNsRrIj5435CW6V34OsfCkFkjeHz17w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYjlQRGVmRnRGbjNNT3dC
+            cWJCWmtrM1BnbE80QnpTWXdHMytqSmFHOVhjCm9LYzd4R2s1TENIVkFYK3g4STRk
+            cGIxMS9RQ2Y1dmR6RjZYeVF5LzRoelkKLS0tIEdjaGk2WnNCRVA0S1dxRzJyWFc3
+            Yzh0MlFSZTR0Z0RhUnhHQzRSbFRXaUEK+5jadT4PMWPrljNcXVW3S1yJ1nI0iei8
+            htf09S2S5jraIFkl2x6Rv8IqOnKVPPgTZkvZqPMQoM4zcs+o1/lnug==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
    lastmodified: "2026-07-05T01:59:20Z"